SonicWall SMA1000 SSRF Vulnerability: Third Max Flaw

A third maximum-severity flaw in three months has been fixed in SonicWall’s SMA1000 remote-access appliances, and this SonicWall SMA1000 SSRF vulnerability may already be under attack. SonicWall’s October advisory describes an unauthenticated server-side request forgery rated CVSS 10.0. A security firm says its honeypots saw exploitation attempts, while SonicWall says it has no evidence of exploitation. If you run an SMA1000, patch now rather than waiting for the two sides to agree.

What Happened

The flaw is CVE-2026-102255, in the Appliance WorkPlace interface of SMA1000 models 6210, 7210 and 8200v. SonicWall tracks it as SNWLID-2026-0017, together with three authenticated flaws (CVE-2026-102256 to -102258, one of them an OS command injection rated 7.8). A remote attacker without credentials can make the appliance send requests on their behalf and reach internal functions. SonicWall lists no workaround. Affected are firmware 12.4.3-03526 and earlier and 12.5.0-02952 and earlier; The Hacker News and Daily Security Review name 12.4.3-03670 and 12.5.0-03082 as the fixed builds, delivered as a hotfix through MySonicWall that restarts the appliance. Singapore’s CSA alert lists different, lower numbers, which look like an error; confirm against the advisory.

On the exploitation question, the sources disagree. Previdian reports that its honeypots recorded crafted OPTIONS requests to the WorkPlace Extraweb interface aimed at the appliance’s internal CouchDB service on the loopback address. That is one source describing attempts, not confirmed compromises. SonicWall’s advisory does not flag exploitation, and we found no CISA KEV entry as of October 9. The reports we read do not say whether this flaw relates to the September CVE pair.

Why It Matters

This is the third time since July. In July we covered an unauthenticated RCE chain in the same appliance line (CVE-2026-15409 and CVE-2026-15410), and in September a second one (CVE-2026-83548 and CVE-2026-83549), exploited and added to CISA KEV. At the time we wrote that a third occurrence would be a governance conversation, not just a patching one. It has now happened, and this time the flaw is SSRF rather than the earlier RCE chain.

For DACH, we have no data on how many SMA1000 appliances are exposed and no known German victims. Assessment: an internet-facing remote-access gateway that has needed an emergency fix three times in one quarter belongs on the risk register as a recurring exposure, not as three separate tickets.

What You Should Do Now

1. Check your SMA1000 firmware and install the October hotfix (12.4.3-03670 or 12.5.0-03082 or later) through MySonicWall. Verify the build numbers in SNWLID-2026-0017 before you rely on any summary.
2. Confirm that the July and September fixes are also in place on every appliance; one hotfix does not cover the others.
3. Review web and appliance logs from the past weeks for unusual OPTIONS requests to the WorkPlace interface. We have no published indicators of compromise for this flaw.
4. Restrict management and WorkPlace access to what users need, and watch CISA KEV and SonicWall’s advisory for an exploitation update.

DIESEC Perspective

Patching alone no longer covers this product line. Decide now whether SMA1000 stays your remote-access architecture, with the monitoring to match, or whether it is time to plan a replacement.

Want an outside view on your remote-access exposure? Contact DIESEC for an external attack-surface check and a review of your remote-access architecture.

Sources: The Hacker News | BleepingComputer | CSA Singapore | Cloud Security Alliance
Published: 2026-10-14 | Category: Vulnerabilities & Patches | ~4 min read